Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01/02/2024, 06:08
Static task
static1
Behavioral task
behavioral1
Sample
8622da09e1743affcd0fc4b61b4ff682.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8622da09e1743affcd0fc4b61b4ff682.html
Resource
win10v2004-20231215-en
General
-
Target
8622da09e1743affcd0fc4b61b4ff682.html
-
Size
73KB
-
MD5
8622da09e1743affcd0fc4b61b4ff682
-
SHA1
31e3d78f1bebfbe051adc388e0dcf9f6aad84d29
-
SHA256
70a67aeb1977ea695d81e32ca50599fca4b76db6aac6e16e4feff46f22d39009
-
SHA512
0c85c9073d6fc7adde62c61b060c477fff22ecbbcf3ba285cda355d6e681f319b25802f41e9517ff10bfa254713d597a033fded4e4873a31e894e22b21c455f5
-
SSDEEP
1536:SsZ/WvSFQv77W5wt6n9g9b91y0GLrByAFVt7A/0:Si/WvSFQv77W5wt6J1x7Z
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412929584" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55F26061-C0C8-11EE-95F4-C273E1627A77} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3028 iexplore.exe 3028 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2172 3028 iexplore.exe 28 PID 3028 wrote to memory of 2172 3028 iexplore.exe 28 PID 3028 wrote to memory of 2172 3028 iexplore.exe 28 PID 3028 wrote to memory of 2172 3028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8622da09e1743affcd0fc4b61b4ff682.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5ffdf7ee5a80380be87ac36ee1d1ad437
SHA1520d1dbeab65a028d1947f733d9468842b87aa03
SHA2566ad93b48c3ec896b803327084e6a6af9d842b1daefa205d133bab357b3e0c960
SHA512993bb2b912e9aad6665addc4bf20e4e5a6cbc23aa7a1f1b5d3a7ab64966b6e8da36900fe04a52b7947b7a3bf21a3e89c53fdbecb700de29b48e208415465b981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5793e3c874889a3ef3e7877acacfdf9c6
SHA1fedf989bd46a2cf7977d3861f802acbc0e3db0d2
SHA256697183bcb0d1311b8752d20d6aebf3b330023868781bfaf2fdc717d6076b4d68
SHA512b5c0e595a481faf76a0d950906cefbb704002194d472647539c0f3d16096d9da15a9c673b18d641f511b425adf3ca8d35290c2c2b2e9674dbb02638074d66a41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c93f209e0ee7edaed6d45bf1b2ec0f7
SHA19eb42ca3edd072c63b6fd4f7bb51d19d5960b8f6
SHA2568a7f46183510db0eac0a84384502652de37156fe677f9658a1ac86ed4b325077
SHA512aeca53b22083e4d6d3c90c56232ebb494a976a288ebf29df8050fd2b2d592eed6299cf525c99ac9e5d8861a0d96ed957e9561a15e0445adba2020e7abfe14642
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d241fa577cd3689e2cdf07672061cd65
SHA1aa9ff64786572b5767c846fe905f66b047ee8479
SHA256400de34fe60f85d89ffd6966b45e1b0e28c5e83d4cfaebfa92bd2d26890ff02c
SHA512482d5c7cee3cd6e2ba1c271d2f9b358cec2838e8eceffb09fceea6e220c9467b257bea8c3ca736bca096360b3ac07c24e68a2551305e07d04399b4a081595880
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a17b73cb7044943eed75c6b122961a5c
SHA156fa640bfde29728ea685c35f3f7bc7cf2dfeb02
SHA2567330e997184de416cd341000bf550532d542bc3087bd8140f24bcba8d8599a5f
SHA512f735e95e80b4525c38315ac2c5575cb9c36664d5f459c3e90339975d871894184295e85b456cf8b47a70b88d68b294cedd779873510471c5d68b45b9964b21b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afc6bb8cb82cb54f579660166f9bc646
SHA16ad5d508a6fe18e449ace5f62c0695247af65468
SHA25600d33f5d70df2ffc6a22333813d605e1b136445045ae33a99b8234c77b6267bd
SHA512877d974ae4595bc9edcf1c3834d873d7b83bc03c9010d4e172766475dc1a3cf513dfc39d16788f499b0ace9f3fdb93d543272817f6b536692894be8bc58241f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5951d44961696f2194fd10ecdc1a33678
SHA1f4781bdf270016b5795f1f3011b9f6f292d337c5
SHA256f4e993503c288f9df6e3730ba85105402787b28516cf2ec800a32c9c2a689f54
SHA51265253a82fa0df288f83b5d358754aeded9ecefed31bf3b88113c73e212ddb13b9abd137cf52fe6291194c7da918ffc06ef56cb6cf8d3f55f604a3781fbcfed92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6650c426083c22555d14dee834d6bc4
SHA1787cacd6efd92b43c954fc9a6e29db671efe1b47
SHA256f062e95e67e60498e4d31378899a2a7370fd6b4e5402d8eca57128e54247c89b
SHA512d5469260502cae2771e86e1af64f19b46a4eb0d99287304211ee13879e7eb6ce85f4be9947fc75e8d14b6ba3bdf7b7122f54e10069d1223013ea5297227dd7ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ce4cf42dabf30468d451f85b9ee2238
SHA1837ee9ae127cadc005a075ec39c58d0280c377a8
SHA2560a01b9c2be5da35e72e62a2cf631346603dc2f9c44838908bde611cdf4a6fd66
SHA51249bd854dcf09de9eb8630b6513061a27cc21d07fbecf7e3bf9896feb40a27afcf6384a38e156629c95336404a7fa14926d84736c996c1cd933adf83d07b4b0aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b1f7ea130658785f6641cdba2f8cbc4
SHA1b1efd924281ffccc1a5a3b1a2c97cf44492b8c7f
SHA25683c6028d9ccde77ee0e30ebe28b5e2169cbc7627d66ff54c7166ea3f00ffd3b3
SHA5121ce6b71be9d6c3f6c48b701c7bd185f01e95edcefaa99ab0be9c81fa5baf3ff65d14bdeac3323e5d4dd5d14da9f16927f980eef95b6b2747d7ebba60e09d9196
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD527cfe6cf9c6879b3316515679a589cb3
SHA1e7446e8c859000730ecfc8125d5866c869dae355
SHA256d2ec7ddfea4c00a3c006a2c16d56c1ed5feb535a257cbea68493dd5b78898dd5
SHA512c0da496e0bdcce60b97fd07908b584e3ce8877e85f2f3d087d9cba537a7ac88f82a8030bb89007f4e86560eb91119c54dcaad1e043f335e7e0615b0ef379c479
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06